RHEL 10 – SELinux AVC denials break custom web application after update – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Web requests fail after update and application logs show permission errors despite correct Unix file ownership.

Environment & Reproduction

Observed after package updates that changed file paths, labels, or service behavior.

getenforce
ausearch -m avc -ts recent | tail -n 30

Root Cause Analysis

SELinux type enforcement blocks newly introduced access paths not covered by existing policy.

Quick Triage

Validate denial pattern and affected service context quickly.

getenforce
systemctl status httpd
firewall-cmd --list-services
journalctl -u httpd -n 50 --no-pager
ausearch -m avc -ts recent

Step-by-Step Diagnosis

Map denials to required allow rules and file contexts.

sealert -a /var/log/audit/audit.log | head -n 120
ls -Z /var/www /var/www/html -R | head -n 80
ausearch -m avc -ts recent | audit2why

Solution – Primary Fix

Restore proper contexts and create a minimal local module only when needed.

sudo restorecon -Rv /var/www
sudo setsebool -P httpd_can_network_connect 1
sudo ausearch -m avc -ts recent | audit2allow -M local-webapp
sudo semodule -i local-webapp.pp
sudo systemctl restart httpd

Solution – Alternative Approaches

Relabel custom app paths with predefined httpd_t-compatible types.

sudo semanage fcontext -a -t httpd_sys_rw_content_t '/opt/myapp/data(/.*)?'
sudo restorecon -Rv /opt/myapp/data

Verification & Acceptance Criteria

No new AVC denials appear during normal traffic and app endpoints succeed.

curl -I http://localhost/health
ausearch -m avc -ts recent | tail -n 20
journalctl -u httpd -n 60 --no-pager

Rollback Plan

Remove local policy module and revert changed booleans if behavior regresses.

sudo semodule -r local-webapp
sudo setsebool -P httpd_can_network_connect 0

Prevention & Hardening

Include SELinux validation tests in deployment pipelines for new app paths.

semanage boolean -l | grep httpd
getenforce

Related Errors & Cross-Refs

Related to mislabeled bind mounts, container contexts, and policy package upgrades.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux troubleshooting with sealert, audit2allow, and Red Hat policy docs.